Architecture
Trust Architecture
How SPA is structured, who controls what, and how your capital is handled.
SPA operates as a paper trading system through go-live. This page documents the control architecture, data flows, and operational safeguards that govern how the system works. Transparency is the product.
Custody Model
Paper trading phase: no real capital involved. Virtual $100,000 USDC portfolio.
Live phase (planned): self-custodial model. Users retain control of assets via Gnosis Safe multisig. SPA operates as an authorised keeper with limited execution rights.
SPA does not hold user funds in a centralised custodian.
Keeper permissions: rebalance within approved whitelist only. Cannot withdraw to external addresses.
The 9 Key Questions
Key questions about the system architecture.
Q1
Who can change the strategy?
Strategy parameters are defined in RiskPolicy v1.0. Changes require a documented ADR (Architecture Decision Record), version bump, and re-run of GoLiveChecker. No undocumented changes.
Q2
Who can change RiskPolicy?
RiskPolicy changes require explicit versioning. Currently v1.0. Any change produces a new version with documented rationale. Changelog is public in repository.
Q3
Who can pause deposits?
The two-tier kill switch responds to peak-to-current drawdown: (1) SOFT at ≥5% — de-risk (halt new entries and position increases, no liquidation); (2) HARD at ≥10% — whole portfolio to cash. It can also be triggered manually by the operator. Both paths are logged.
Q4
Who can close positions?
In paper trading: automated rebalancer only, within RiskPolicy gates. In live phase: keeper (automated) within approved permissions + multisig emergency override.
Q5
Who can upgrade contracts?
Live phase: multisig required for any contract upgrade. Timelock TBD before go-live. Paper trading phase: no live contracts deployed.
Q6
Can a human override a risk gate?
No. In paper trading phase, blocked rebalances are logged but not executed. The gate result is final. Manual override capability is explicitly excluded from keeper permissions.
Q7
Is there a multisig, and who are the signers?
Gnosis Safe multisig planned for live phase. Signer composition and threshold TBD before go-live. Will be published in this document before July 2026.
Q8
Where can I see all logs?
Dashboard → Trades tab (all rebalance events), Dashboard → Risk Blocks tab (all blocked rebalances), and a version-controlled audit log (JSON logs, ADRs, RiskPolicy versions).
Q9
What happens during an incident?
1. Kill switch activates by tier: SOFT (≥5%) de-risk, HARD (≥10%) all to cash.
2. Operator notified via monitoring alerts.
3. Exposure is reduced (SOFT) or the portfolio moves fully to cash (HARD).
4. Incident documented and published.
5. No resumption until root cause identified.
Identity Verification
No identity verification required to view strategies or dashboard.
Currently paper-only — no deposits. In any future live phase, verification procedures will be documented here.
This is a paper research project. No funds are managed. See architecture above for planned live phase controls.
Incident Communication
In the private MVP phase, incident communication is handled directly via the request form and Telegram. Response owner: the desk operator. Public status page and formal SLA will be added before public launch.
Contract Transparency
We publish the list of approved DeFi protocol brands we work with: Aave, Compound, Morpho. Full contract registry will be published after security audit completion (planned Q3 2026). Operational wallet addresses are not published.
Operational Model
Daily Cycle
Scan → Gate → Rebalance (automated)
LLM in Execution
None. Zero AI in the decision path.
Decision Logic
All decisions deterministic and logged
Paper Trading
No real transactions — all operations simulated
Live Monitors
Contact
For due diligence inquiries: via the request form on /pilot →